diff --git a/.gitignore b/.gitignore
index 4c301811a..6886423f9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -52,6 +52,23 @@ asn1_*.[cx]
 /setupbuild.cmd
 /ylwrap
 
+/lib/libedit/aclocal.m4
+/lib/libedit/autom4te.cache
+/lib/libedit/compile
+/lib/libedit/config.guess
+/lib/libedit/config.log
+/lib/libedit/config.status
+/lib/libedit/config.sub
+/lib/libedit/configure
+/lib/libedit/depcomp
+/lib/libedit/install-sh
+/lib/libedit/libtool
+/lib/libedit/ltmain.sh
+/lib/libedit/missing
+/lib/libedit/setupbuild.cmd
+/lib/libedit/ylwrap
+
+
 # Files in subdirectories.
 
 /admin/ktutil
diff --git a/lib/gssapi/gssapi/gssapi.h b/lib/gssapi/gssapi/gssapi.h
index a779904d0..c74ff86c9 100644
--- a/lib/gssapi/gssapi/gssapi.h
+++ b/lib/gssapi/gssapi/gssapi.h
@@ -895,13 +895,13 @@ GSSAPI_DEPRECATED GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL gss_unseal
  */
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
-gss_encapsulate_token(const gss_buffer_t /* input_token */,
-		      const gss_OID /* oid */,
+gss_encapsulate_token(gss_const_buffer_t /* input_token */,
+		      gss_const_OID /* oid */,
 		      gss_buffer_t /* output_token */);
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
-gss_decapsulate_token(const gss_buffer_t /* input_token */,
-		      const gss_OID /* oid */,
+gss_decapsulate_token(gss_const_buffer_t /* input_token */,
+		      gss_const_OID /* oid */,
 		      gss_buffer_t /* output_token */);
 
 
diff --git a/lib/gssapi/mech/gss_decapsulate_token.c b/lib/gssapi/mech/gss_decapsulate_token.c
index 0fe3b4f5a..e4bb31738 100644
--- a/lib/gssapi/mech/gss_decapsulate_token.c
+++ b/lib/gssapi/mech/gss_decapsulate_token.c
@@ -34,8 +34,8 @@
 #include "mech_locl.h"
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
-gss_decapsulate_token(const gss_buffer_t input_token,
-		      const gss_OID oid,
+gss_decapsulate_token(gss_const_buffer_t input_token,
+		      gss_const_OID oid,
 		      gss_buffer_t output_token)
 {
     GSSAPIContextToken ct;
diff --git a/lib/gssapi/mech/gss_encapsulate_token.c b/lib/gssapi/mech/gss_encapsulate_token.c
index fc0ec736b..394b355d5 100644
--- a/lib/gssapi/mech/gss_encapsulate_token.c
+++ b/lib/gssapi/mech/gss_encapsulate_token.c
@@ -34,8 +34,8 @@
 #include "mech_locl.h"
 
 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
-gss_encapsulate_token(const gss_buffer_t input_token,
-		      const gss_OID oid,
+gss_encapsulate_token(gss_const_buffer_t input_token,
+		      gss_const_OID oid,
 		      gss_buffer_t output_token)
 {
     GSSAPIContextToken ct;
diff --git a/lib/hdb/hdb-mitdb.c b/lib/hdb/hdb-mitdb.c
index ccc98da67..85bfc2a37 100644
--- a/lib/hdb/hdb-mitdb.c
+++ b/lib/hdb/hdb-mitdb.c
@@ -220,17 +220,17 @@ mdb_value2entry(krb5_context context, krb5_data *data, krb5_kvno kvno, hdb_entry
     if (u16 != KDB_V1_BASE_LENGTH) { ret = EINVAL; goto out; }
     /* 32: attributes */
     CHECK(ret = krb5_ret_uint32(sp, &u32));
-    entry->flags.postdate =	 !(u16 & KRB5_KDB_DISALLOW_POSTDATED);
-    entry->flags.forwardable =	 !(u16 & KRB5_KDB_DISALLOW_FORWARDABLE);
-    entry->flags.initial =	!!(u16 & KRB5_KDB_DISALLOW_TGT_BASED);
-    entry->flags.renewable =	 !(u16 & KRB5_KDB_DISALLOW_RENEWABLE);
-    entry->flags.proxiable =	 !(u16 & KRB5_KDB_DISALLOW_PROXIABLE);
+    entry->flags.postdate =	 !(u32 & KRB5_KDB_DISALLOW_POSTDATED);
+    entry->flags.forwardable =	 !(u32 & KRB5_KDB_DISALLOW_FORWARDABLE);
+    entry->flags.initial =	!!(u32 & KRB5_KDB_DISALLOW_TGT_BASED);
+    entry->flags.renewable =	 !(u32 & KRB5_KDB_DISALLOW_RENEWABLE);
+    entry->flags.proxiable =	 !(u32 & KRB5_KDB_DISALLOW_PROXIABLE);
     /* DUP_SKEY */
-    entry->flags.invalid =	!!(u16 & KRB5_KDB_DISALLOW_ALL_TIX);
-    entry->flags.require_preauth =!!(u16 & KRB5_KDB_REQUIRES_PRE_AUTH);
-    entry->flags.require_hwauth =!!(u16 & KRB5_KDB_REQUIRES_HW_AUTH);
-    entry->flags.server =	 !(u16 & KRB5_KDB_DISALLOW_SVR);
-    entry->flags.change_pw = 	!!(u16 & KRB5_KDB_PWCHANGE_SERVICE);
+    entry->flags.invalid =	!!(u32 & KRB5_KDB_DISALLOW_ALL_TIX);
+    entry->flags.require_preauth =!!(u32 & KRB5_KDB_REQUIRES_PRE_AUTH);
+    entry->flags.require_hwauth =!!(u32 & KRB5_KDB_REQUIRES_HW_AUTH);
+    entry->flags.server =	 !(u32 & KRB5_KDB_DISALLOW_SVR);
+    entry->flags.change_pw = 	!!(u32 & KRB5_KDB_PWCHANGE_SERVICE);
     entry->flags.client =	   1; /* XXX */
 
     /* 32: max time */
diff --git a/lib/krb5/version-script.map b/lib/krb5/version-script.map
index de95c020d..abda458fc 100644
--- a/lib/krb5/version-script.map
+++ b/lib/krb5/version-script.map
@@ -167,6 +167,7 @@ HEIMDAL_KRB5_2.0 {
 		krb5_copy_checksum;
 		krb5_copy_creds;
 		krb5_copy_creds_contents;
+		krb5_copy_context;
 		krb5_copy_data;
 		krb5_copy_host_realm;
 		krb5_copy_keyblock;